Poppler
125 CVEs tracked. 1 of them are in CISA KEV.
This hub aggregates every CVE we track for Poppler, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Poppler CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 1 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 3 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 1 |
| 2025-08 | 2 |
| 2025-09 | 0 |
| 2025-10 | 2 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 4 |
Severity
How the 125 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical7
- High38
- Medium77
- Low3
Latest CVEs
The 15 most recently published vulnerabilities affecting Poppler.
- CVE-2026-93314Freedesktop Poppler FoFiTrueType.cc mapCodeToGID integer overflow6.3
- CVE-2026-93313Freedesktop Poppler JBIG2Stream.cc readCodeTableSeg integer overflow6.3
- CVE-2026-93312Freedesktop Poppler JBIG2Stream.cc rewind null pointer dereference4.3
- CVE-2026-93311Freedesktop Poppler SampledFunction Function.cc integer overflow4.3
- CVE-2025-52885GHSL-2025-042: Poppler has Use-After-Free7.3
- CVE-2025-43718Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expr...2.9
- CVE-2025-50422Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c.2.9
- CVE-2025-50420An issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an infinite recursion via supplying a crafted PDF file. This can lead to a Denial of Service (DoS).6.5
- CVE-2025-52886Poppler Use After Free Vulnerability5.9
- CVE-2025-43903NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.4.3
- CVE-2025-32364A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.4.0
- CVE-2025-32365Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.4.0
- CVE-2024-56378libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.4.3
- CVE-2024-6239Poppler: pdfinfo: crash in broken documents when using -dests parameter7.5
- CVE-2022-37051An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.6.5
Product grouping is registry-driven, with AI assist and human review. How it works